Why a casino suddenly asks about your money, and what it is allowed to ask for

The threshold that catches most people

Great Britain runs a light-touch financial vulnerability check under licence condition 3.4.4. It began on 30 August 2024 at £500 of net deposits in a rolling 30-day period, and the threshold dropped to £150 on 28 February 2025. Net deposits means deposits minus withdrawals, so a player who deposits £400 and takes £300 back out has net deposits of £100 and has not crossed it.

The check itself is designed to be frictionless and is meant to happen without you noticing. It looks at publicly available markers of financial distress — bankruptcies, individual voluntary arrangements and similar county court records — and not at your salary, your postcode or your job title. On the overwhelming majority of accounts nothing happens, nothing is requested, and the player never learns a check took place.

The friction appears when something flags. At that point the operator has to assess the flag and act proportionately, and "proportionately" is where operator practice varies enormously. Some ask a single question. Some freeze deposits until documents arrive. The licence condition sets the trigger; it does not script the conversation that follows.

A separate and more intrusive regime — full financial risk assessments, which look at actual affordability rather than public distress markers — has been running as a pilot rather than as a live requirement. If an operator tells you a "mandatory affordability check" obliges it to see three months of bank statements at a modest level of spend, that is the operator's own risk policy speaking, not a rule handed to it by the regulator.

What an operator may reasonably ask for

• Identity documents: passport, driving licence or national identity card. Standard, and asked of everyone eventually under anti-money-laundering rules.
• Proof of address: a utility bill or bank statement dated within the last three months.
• Source of funds, where the sums are large or unusual for the account: payslips, a bank statement showing salary, or evidence of a specific windfall such as a property sale or an inheritance.
• An explanation of a pattern rather than a document: why deposits jumped tenfold in a week, for example.

What should make you stop and look harder

The single clearest warning sign is timing. Documents requested when you open the account, or before a first withdrawal, are a process. The same documents requested for the first time immediately after a win, with the withdrawal held until they clear, is a pattern the regulator has fined operators over and one this site scores explicitly: an operator that publishes its document list in advance earns the points, and one that reserves the right to ask at any time does not.

The second is scope creep. A source-of-funds request is answered by evidence that the money is legitimately yours. It is not answered by handing over an unredacted bank statement covering every transaction of your life, and you are entitled to redact entries that are irrelevant to the question asked, provided the balance, the name and the salary credits remain visible.

The third is a check that never ends. A legitimate review has a decision at the end of it. If each document you provide produces a request for another, and no one will tell you in writing what would close the review, you have moved from a check into a stall — and that is the point at which the complaints route below exists.

Your account is frozen. What now?

Ask for three things in writing, in one message: the specific reason the account is restricted, the exact list of documents that would resolve it, and the timescale the operator works to. Written and specific matters — it converts a vague hold into something a dispute body can later measure the operator against.

Send exactly what was asked for, in the format asked for, and keep a copy of every file with the date you sent it. Do not send more than was asked for in the hope of speeding things up; it slows things down and hands over information the operator did not need.

If the account holds a balance you want out, say so explicitly in the same message and ask that the withdrawal be processed once the review completes. An operator is entitled to hold a payment while it completes a check. It is not entitled to leave the balance in an account you cannot access indefinitely with no decision.

If two weeks pass with no decision and no substantive answer, ask for a final response. That phrase has meaning: it starts the clock on the complaints route, and any operator licensed in Britain knows exactly what it is being asked for.

Why the rules exist, and the honest trade-off

The case for checks is straightforward and evidenced: gambling losses concentrate heavily among a small number of accounts, and a proportion of those accounts belong to people in genuine financial trouble. Public-record markers of distress are a cheap way to spot some of them without asking anyone to justify their spending.

The case against is equally real. Checks push some players toward operators outside the British licensing perimeter, where there is no check, no GAMSTOP and no complaints route — which is worse for exactly the people the rule protects. That is the trade-off the regulator has been arguing about publicly for years, and reasonable people land in different places on it.

What is not in dispute is what happens to you as an individual player. Inside the perimeter, a check is an inconvenience with a decision at the end and an appeal route if the decision is wrong. Outside it, there is no check, and also nobody to complain to when a withdrawal stops arriving. Those two facts are the same fact seen from two sides.

Two different checks wearing the same name

People use "financial check" for two processes that have different legal bases and different remedies, and separating them makes the whole subject navigable.

The first is anti-money-laundering. Its question is where the money came from. It is driven by law and by the operator's licence conditions, it escalates on deposit volume and on patterns the system flags, and it is not negotiable — an operator that fails here faces the kind of penalty that appears in the enforcement cases we mirror on this site.

The second is affordability, sometimes called a customer-interaction or vulnerability check. Its question is whether the amount you are gambling is sustainable for you. It is driven by the social-responsibility side of the licence, it escalates on losses rather than on deposits, and it is the area where the regulator has been most active in recent years.

They can ask for similar documents and they mean different things. A source-of-funds request after a large deposit is the first. A request triggered by three weeks of steady losses is the second, and it is likely to come with limits attached rather than just a document upload.

What the enforcement record shows about these checks

This is one subject where the regulator has published a great deal about what it expects, in the form of settlements against operators that got it wrong. Those notices are worth reading precisely because they are specific.

The findings repeat with unusual consistency. Systems that relied on financial triggers alone rather than on behaviour. Alerts that fired but produced no meaningful action. Customers who lost five-figure sums within days before anybody made contact. Interactions that were sent but never evaluated for whether they had changed anything.

Two consequences follow for a player. First, the checks you experience are the operator's response to that record, which is why they have become more common and more intrusive — an operator that under-checks now faces a penalty measured in millions. Second, and less comfortably, the record shows that the checks failed often enough for the regulator to intervene repeatedly, so they are not something to rely on as a personal safeguard.

We mirror the Commission's enforcement feed and print the findings of each case on the reviews of every brand run by the licensee concerned. Reading two or three of them tells you more about how this industry is supervised than any explainer, including this one.

What you can decline, and what happens if you do

You can decline any request. The operator can then decline to let you continue, which is the practical shape of the choice.

Declining a source-of-funds request normally results in the account being restricted and eventually closed, with your own funds returned to source. Winnings are the contested part: an operator that cannot satisfy its AML obligations will generally not pay them, and adjudicators have tended to support that where the request was proportionate.

Declining an affordability request usually results in limits rather than closure — a deposit cap set by the operator at a level it considers sustainable without evidence to the contrary. Many players find this a reasonable outcome and simply accept the cap.

What is not reasonable, and is worth challenging: an open-ended request with no list of acceptable documents, a demand for a full unredacted bank statement covering years, or a request that keeps expanding after each submission. Ask, in writing, for the specific documents required and the specific concern being addressed. A well-run operator answers that question; one that cannot is exposed at adjudication.

Preparing so it never becomes a problem

• Verify fully when you open the account, before anything is at stake. Identity, address and — if you intend to deposit meaningfully — a source-of-funds document held ready.
• Keep gambling deposits on one payment method in your own name. Third-party payments are refused by British operators and are the fastest way to turn a routine check into a closure.
• Set your own deposit limit at a level you would defend to a stranger. It answers the affordability question before it is asked, and it is visible to the operator as evidence of control.
• Save payslips or statements as original PDFs rather than photographs. Rejected documents are the main cause of a check taking a fortnight rather than two days.
• If your income is irregular — self-employment, contract work, bonuses — expect more scrutiny rather than less, and have the documents that show a full year rather than a good month.

What good practice looks like from the outside

• The documents are published in advance. An operator that names what it will ask for — passport or driving licence, utility bill or bank statement — has converted an unpredictable intrusion into a known step.
• The trigger is published too. Almost nobody does this, and it is the half that decides whether a withdrawal stalls. An operator saying "we review accounts at £X of cumulative deposits" is being genuinely transparent.
• The request is specific. A list of acceptable documents and a stated concern, rather than an open-ended demand that expands with each submission.
• The account keeps working where it safely can. Restricting deposits while a review runs is proportionate; freezing a verified balance the customer has already won usually is not.
• There is a named human route. A review that can only be discussed with a scripted chat agent is a review with no way to resolve an obvious misunderstanding.
• Deposit limits are easy to find and immediate to lower. An operator that makes lowering a limit instant and raising it slow is designing in the right direction; the reverse is a warning about everything else.

The trade-off, stated honestly

There is a real cost to this regime and it is not only inconvenience. Handing bank statements to a gambling company is a genuine privacy loss, the checks fall unevenly on people with irregular incomes, and a stalled withdrawal feels identical whether the cause is diligence or obstruction.

There is also a real benefit, documented in the same enforcement notices: the customers cited in those cases lost sums that changed their lives, over days, while automated systems did nothing. The checks exist because that happened repeatedly at operators large enough to know better.

Our position on this site is not to argue the policy but to make the operator's side of it visible. Which documents an operator says it will ask for, and when, is a disclosure it controls — and one that turns an unpredictable intrusion into a known step. We score both halves, and most operators publish neither.

If you take one thing from this guide: do the checks early, at a moment of your choosing, with nothing pending. Everything difficult about this subject comes from doing it late.

Questions

Read next